For fun, and in my spare time I'm creating a simple CMS for my own purposes (with hopes to release for wider use... later), using PHP. I'm currently working on the login scheme now, and have a few questions.
Note: The end result is always passed through crypt using blowfish and a cost parameter of 15 (Generally hoping that a cost param of 15 is long enough to hurt hacking attempts, but not long enough to frustrate users.)
Question 1: Assuming I'm using SSL/TLS: Do I really need to obfuscate the password any, before passing it to bcrypt (with the given parameters and a proper salt) and pushing it to the database?
Question 1.a: Since I don't have access to SSL/TLS (too costly from my webhost at the moment), is using the whirlpool hash (or something from the sha-2 family) client-side on the password before passing it to the server, a "good enough" case of security, or is that hash vulnerable to rainbow table attacks? (This assumes that I'm trying to put a tent flap on a tent, not on a bank vault. Bank vaults can afford SSL/TLS.)
Question 2: Is it worth it to create a new salt for the password every time the user logs in again, or do I just need to create a unique salt for that user of appropriate entropy when they register, and leave it?